6 Network Security

Security goals and threat landscape

Network security protects the confidentiality, integrity, and availability (CIA) of data and services. Because a single control can fail, secure networks combine complementary measures to reduce the chance or impact of a compromise.

Threats can target people, devices, applications, network services, or physical infrastructure. Defenses therefore need to address more than the Internet perimeter.

Common network threats

Threats may exploit technical weaknesses, deceive users, misuse access, or disrupt services. Common examples include:

• Malware: Malicious software includes viruses, worms, ransomware, and spyware. A worm can spread across networks without a user opening an infected file; ransomware may encrypt files and disrupt services.

• Phishing and social engineering: Attempts to trick people into revealing credentials, approving access, or running malicious content. Stolen credentials can make an attacker’s activity look legitimate.

• Credential attacks: Brute-force and password-spraying attempts guess passwords; credential stuffing reuses passwords exposed in other breaches.

• Denial-of-service (DoS/DDoS): Flooding a service or exhausting its resources so legitimate users cannot access it.

• On-path attacks: An attacker intercepts or alters communications, often by exploiting an untrusted network or weak encryption.

• Spoofing and poisoning: Forged identity or network information, such as IP, MAC, or DNS data, can redirect traffic or bypass weak controls.

• Exploitation and lateral movement: Attackers exploit vulnerable or misconfigured systems, then move from the initially compromised device to other systems.

• Insider threats: A trusted user may misuse legitimate access deliberately or accidentally.

Layered and controlled network design

A secure design uses defense in depth: combine authentication, firewalls, endpoint protection, encryption, monitoring, and backups rather than relying on one device. Apply least functionality by disabling unnecessary ports, protocols, services, and accounts, and keep systems securely configured and patched.

A DMZ is a separate network for public-facing services, such as web or mail servers. Firewalls restrict which connections may pass between the Internet, the DMZ, and the internal network. For example, Internet users may be allowed to reach a web server in the DMZ, while connections from that server to an internal database are limited to the required application traffic. A DMZ does not replace the need to protect the servers inside it.

Zero trust means not granting implicit trust solely because a user or device is inside the corporate network. Verify identity and device context, authorize access to the specific resource, and reassess access as appropriate.

Identity and access controls

Access controls distinguish who is requesting access from what that identity may do. Authentication establishes who or what is requesting access; authorization determines what that identity is permitted to do. Accounting and auditing record activity so it can be reviewed. These functions are sometimes summarized as AAA.

Important practices and mechanisms include:

• Least privilege: Give an account only the permissions needed for its role, and remove access when it is no longer needed.

• Multifactor authentication (MFA): Require evidence from at least two different factor categories: something the user knows, has, or is. A password plus an authenticator-app approval uses two categories; two passwords do not.

• Role-based access control (RBAC): Assign permissions to job roles, then assign users to roles. A network-operations role can manage switches while a standard-user role cannot.

• Attribute-based access control (ABAC): Make access decisions using attributes such as user, device, resource, location, or time.

• Access control lists (ACLs): Permit or deny traffic or resource access according to defined rules. Network ACLs commonly match addresses, protocols, and ports; rule order and the default action matter.

• Network access control (NAC): Check a connecting device or user against policy. NAC may deny, limit, or quarantine a device that does not meet requirements.

Segmentation and containment

Network segmentation divides a network into smaller physical or logical zones and controls traffic between them. It can use separate switches, VLANs, subnets, firewalls, or host-based policies. A VLAN separates Layer 2 broadcast domains, but is not automatically a security boundary: routing and firewall rules must restrict traffic between VLANs.

Separate areas such as employee workstations, guest Wi-Fi, servers, management interfaces, and operational technology (OT), and permit only necessary flows between zones. Segmentation limits exposure and can contain a compromise, helping limit lateral movement and reduce an incident’s potential blast radius. Microsegmentation applies similarly narrow controls to individual workloads or services.

Encryption and secure communication

Encryption transforms readable data (plaintext) into ciphertext using a key. It protects confidentiality, but does not by itself prove that data is trustworthy or prevent a service from being taken offline.

• Symmetric encryption uses the same secret key to encrypt and decrypt data. It is efficient for protecting large amounts of data, but the key must be shared securely.

• Asymmetric encryption uses a public/private key pair. It supports secure key exchange and digital signatures; protocols commonly combine it with symmetric encryption for the data session.

• Hashing produces a fixed-length digest for integrity checks. It is not encryption and cannot be reversed to recover the original data. Passwords should be stored using password-hashing methods, not as plaintext.

TLS protects many application connections, such as HTTPS. A VPN creates a protected tunnel across an untrusted network; IPsec is commonly used to protect IP traffic. Encryption can protect data in transit and at rest. Use secure protocols and configurations, validate certificates, and protect cryptographic keys. Encryption cannot prevent an authorized but compromised endpoint from exposing data after it is decrypted.

Defensive technologies and monitoring

Defensive technologies have different roles in allowing or blocking traffic, detecting activity, and supporting response:

• Firewall: Allows or blocks traffic according to policy. Stateful firewalls track connection state; next-generation firewalls may also inspect applications or content.

• IDS / IPS: An intrusion detection system (IDS) monitors and alerts; an intrusion prevention system (IPS) can block or otherwise stop detected traffic. These systems may use signatures, behavior, or both, and may be network-based, wireless, or host-based.

• WAF: A web application firewall filters HTTP/HTTPS traffic to protect web applications from application-layer attacks.

• Proxy / secure web gateway: Relays client requests and may enforce web-access policy, inspect traffic, or filter malicious content.

• Endpoint protection / EDR: Detects or blocks malicious activity on endpoints. Endpoint detection and response (EDR) also supports investigation and response.

• SIEM: Collects and correlates logs and alerts from multiple sources to support detection, investigation, and reporting.

• DLP: Helps detect or prevent unauthorized disclosure of sensitive data.

• Honeypot: A decoy system designed to attract and observe suspicious activity; it should be isolated from production assets.

No detection technology catches everything. Maintain signatures and software, monitor alerts and logs, and tune policies to reduce missed threats and false alarms. In combination, access control, segmentation, encryption, and defensive technologies help restrict communications to what users, devices, and services need while supporting prevention, detection, and investigation.